Method and system for checking modifications to be carried out on the system runtime environment during the installation process

Abstract

The invention relates to a computer-implemented method for carrying out an installation process for an application (APP) on a runtime environment (P) during the operation of a system (S), while checking modifications to be carried out on the runtime environment during the installation process, comprising the following steps: a) configuring at least one installation protection profile (AIIP) for the runtime environment depending on an installation guideline (AIP) provided for controlling the installation process, b) carrying out an installation process of an installation package of the application to be installed for checking purposes on a test runtime environment isolated from the runtime environment using the at least one installation protection profile, which specifies allowed and / or prohibited modifications to the runtime environment during the installation process; c) checking whether the installation process is carried out in accordance with the installation protection profile; d) carrying out the installation process of the installation package to be installed on the runtime environment, if the result of the check is positive; and, e) otherwise, rejecting or aborting the installation process.

Description

[0001] Description

[0002] Method and system for verifying modifications to the system runtime environment during the installation process

[0003] The invention relates to a method and system for carrying out an installation process for an application on a runtime environment during the operation of a system, checking modifications to be carried out on the system runtime environment during the installation process, and to an associated computer program product.

[0004] Since industrial systems (control units, industrial PCs, IoT and edge devices, cloud servers) are often used in the field for extended periods, they are exposed to constantly changing requirements and a dynamic environment. To cope with these circumstances, new devices are being developed to allow for flexible adaptation over their lifetime, e.g., by supporting downloadable applications or apps. Downloading an application is typically performed during operation or runtime of a system or device.

[0005] For example, with an Industrial Edge, which is described at https: / / new.siemens.com / de / de / produkte / automati sie rung / theman-f elder / industrial-edge.html, various manufacturers can provide different apps, for example, in an app store, which are then installed on the device by the device operator. As a result of the broadest possible offering, applications from different manufacturers can adopt different formats (e.g., Docker containers, Debian packages, simple tar archives) and require different levels of integration with the system (e.g., few permissions, very invasive permissions).

[0006] This places greater demands on the security mechanisms of such a device. In particular, secure operation requires a controlled application installation process. An application developer has a certain degree of freedom to determine which parts of a device runtime environment are modified during the installation process. This degree of freedom can vary, particularly depending on the app format. For example, Debian packages can contain installation scripts provided by the app developer and executed with the highest privileges on the system.

[0007] It is possible to restrict the privileges of one or more software components at the system level (see, for example, https: / / www.linux.com / learn / overview-linux-kernel-securityfeatures). Examples of such mechanisms under the Linux operating system include Mandatory Access Control (MAC, for example, SELinux or AppArmor), system call filtering (seccomp), Linux capabilities, and virtualization mechanisms (namespaces). With MAC, for example, application rights are defined using access rules in a policy, which are then implemented by the operating system kernel. If an application performs an operation that is not permitted for it, this can be prevented or reported. This serves as protection against an attacker who has control over one or more applications. In particular, these mechanisms can also be used to restrict the rights of a root user.

[0008] Package managers such as dpkg allow you to detect whether the installation of an application package will result in the overwriting of files belonging to another application package (see, for example, https: / / askubuntu.com / questions / 176121 / dpkg- er ror- trying- to -overwrite-f ile-which-is-also-in) .

[0009] In Linux, an auditing mechanism, such as auditd (https: / / linux.die.net / man / 8 / auditd), can be used to detect and report access events (e.g., write access to a file by an application). These events are then stored in a log file, such as / var / log / audit / audit.log. Under the Windows operating system, an audit policy can be configured to log, for example, changes to specific files (see https: / / blog.netwrix.com / 2018 / 08 / 23 / auditing-windows-server / ). These events are then stored under specific identifiers in the Windows Event Log system, which can be viewed and analyzed.

[0010] The invention is therefore based on the object of designing a method and a system in such a way that a method or system which is improved compared to the prior art is developed for carrying out an installation process for at least one (reloadable) application in a runtime environment, wherein control of modifications to be carried out during the installation process is to be ensured.

[0011] This object is achieved by the features according to the independent patent claims. Advantageous embodiments of the present invention are described in the dependent claims.

[0012] The invention claims a (computer-implemented) method for carrying out an installation process for an application on a runtime environment during the operation of a system while checking or controlling modifications to be carried out on the system runtime environment during the installation process, comprising the following steps: a) Configuring and / or selecting a configuration of at least one installation protection profile for the runtime environment depending on an installation policy provided to control the installation process, b) Carrying out an installation process of an installation package of the application to be installed for checking purposes on a test runtime environment isolated from the runtime environment using the at least one installation protection profile that specifies permitted and / or prohibited modifications to the runtime environment during the installation process, c) Checking,whether the installation process has been carried out in compliance with the installation protection profile, d) carrying out the installation process of the installation package to be installed on the runtime environment if the verification result is assessed as positive, e) otherwise rejecting or aborting the installation process.

[0013] According to the invention, an app installation mechanism is described that is executed for testing purposes in a protected or controlled runtime environment to prevent unwanted modifications to the system during installation. This enables the installation of preferably loadable applications in a manner that ensures the integrity of the remaining system.

[0014] To do this, an installation procedure or process is checked in a test runtime environment isolated from the system runtime environment to determine whether a previously configurable installation protection profile has been adhered to and not violated. For example, a violation of the installation protection profile can occur if operations are performed on a file system, for example, that are not permitted according to the installation protection profile.

[0015] If the verification is positive, the installation process can be completed. If the verification is negative, the installation process will be rejected or aborted, meaning it will not be completed.

[0016] The configuration of at least one installation protection profile (AIIP) is carried out using metadata included in the installation package and / or using states and / or rights of the runtime environment and / or the system.

[0017] The test runtime environment can be isolated from the system runtime environment on the system itself or deployed remotely or separately on another system.

[0018] To control the installation process, an installation control unit can be used, which is configured or can be configured with the installation protection profile(s).

[0019] A report can also be provided alongside the verification result or as the verification result, documenting the modifications made during the installation process. This can then be used to derive a positive or negative verification result.

[0020] The verification result can be cryptographically attested.

[0021] The method is preferably computer-aided or computer-implemented, or is preferably executed in a computer-aided or computer-implemented manner. The steps of the method can be repeated any number of times, and repetitions can be terminated based on defined conditions, either event-driven or time-limited.

[0022] A further aspect of the invention is a system suitable for carrying out an installation process for an application (APP) on a system runtime environment during the operation of a system while checking modifications to be carried out on the system runtime environment during the installation process, wherein the system is designed to carry out the above-mentioned steps a) to e).

[0023] Furthermore, a computer program product can be used, comprising a non-volatile storage medium on which a loadable and executable program code is stored, which executes the method according to one of the above-mentioned embodiments in a processor unit, in particular one or distributed in several devices according to one of the previously described embodiments.

[0024] Additionally, a variant of the computer program product with program instructions for configuring a creation device, for example a 3D printer, a computer system or a manufacturing machine suitable for creating processors and / or devices, is claimed, wherein the creation device is configured with the program instructions in such a way that the execution environment can be created.

[0025] The system or devices, units or devices and computer program (products), which may comprise a loadable and executable program code or distributed loadable and executable program code modules, may be designed according to the further developments / embodiments of the aforementioned method and their further developments / embodiments and vice versa.

[0026] One embodiment of the invention provides that one or more units, components, or devices can be integrated into the system, and these can be implemented as software, firmware, or hardware components. The system typically comprises at least one processor capable of executing operations at the operating system level as the operating system kernel.

[0027] A processor or processor unit can in particular be a main processor (Central Processing Unit, CPU), a microprocessor or a microcontroller, for example an application-specific integrated circuit or a digital signal processor, possibly in combination with a memory unit for storing program instructions, etc. A processor can also be, for example, an IC (Integrated Circuit) or a multi-chip module, in particular an FPGA (Field Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit), an SoC (System on Chip), a graphics processor GPU (Graphics Processing Unit), a processor for evaluating a neural network such as a TPU (Tensor Processing Unit) or a DSP (Digital Signal Processor).The processor can have one or more processing cores (multi-core). A processor can also be understood as a virtualized processor or a soft CPU. It can also be, for example, a programmable processor that is equipped with configuration steps for executing the aforementioned method according to the invention or is configured with configuration steps such that the programmable processor implements the inventive features of the method or other aspects and sub-aspects of the invention. The processor can have tamper protection to protect against physical manipulation, e.g., tamper sensors for detecting physical attacks.

[0028] Embodiments of the invention

[0029] Embodiments of the method and system according to the invention are illustrated by way of example in the drawings and are explained in more detail in the following description. They show:

[0030] Figure 1 shows an exemplary arrangement in the context of which the method according to the invention can be applied, and Figure 2 shows an embodiment of a system which is suitable for carrying out the method according to the invention.

[0031] Figure 1 shows a use of the invention on a system S, which is, for example, an automation component that allows the dynamic addition or reloading of applications (apps) during operation. In a network of an industrial plant, several such systems can be connected to each other via a bus system / network B.

[0032] Figure 2 shows the system S in a more detailed embodiment compared to Figure 1. An app management logic (AML) on the system S receives an app package APP, for example, from an app management system DMS or via a USB stick plugged into the system. The app management logic is configured with an (app) installation policy (AIP) to determine a corresponding installation protection profile AIIP for an app installation logic AIL in an installation control unit (shown in dashed lines in Figure 2). When configuring the installation protection profile or a selection of possibly existing (preconfigured) configurations, a wide variety of factors can be taken into account, such as:

[0033] Metadata, which may include the signature / manufacturer of the app or the origin of the app package (e.g. from which server it was loaded) A manifest file of the app package, in which the changes or modifications made by the installation (e.g. accessed paths) on the system are specified Contents of the installation scripts of the app package Rights of the runtime environment, which the app requires on the system Current system state (e.g. setup or maintenance mode) and information from or about already installed components

[0034] As a rule, an application package or APP package APP is obtained for installing the application on the system S, for example from an app server, here the app management system DML, which is to be installed on the runtime environment P of the system (shown in dotted lines in Figure 2) or on the test runtime environment for testing purposes.

[0035] The app package is checked to configure or select a suitable, device-specific installation protection profile (AIIP). The installation protection profile (AIIP) is applied by: o Starting an app installation process (marked with R in Figure 2) using an app installation policy on the system in a restricted test runtime environment. In this variant, the test system is implemented on the actual system itself. o Or the app package is transmitted to a test runtime environment on a separate system (marked with AIVS in Figure 1), where the installation process is executed in a restricted test runtime environment.

[0036] If the installation process is successfully completed in compliance with the installation protection profile, the modifications triggered by the installation process are adopted or the modifications are applied to the system marked with M in Figure 2.

[0037] - If the installation fails according to the installation protection profile, the installation process will be terminated or aborted. An error message, etc., may be displayed.

[0038] The configured or selected AIIP installation protection profile in Figure 2 can, for example, be a special SELinux or AppArmor profile, a sandbox environment configured using Linux namespaces and bind mounts, or an additional component for monitoring file system access / the integrity of certain files. The app installation logic (AIL) is then executed to install the app package (e.g., a Debian package app-package.deb) using the AIIP installation protection profile, for example, by executing the command dpkg -i app-package.deb under the selected AppArmor or SELinux profile. This also causes all installation scripts of the app package to be executed with specifically restricted rights.

[0039] For example, the AppArmor or SELinux profile can be defined to prohibit access to certain core parts of the system (SC) (system core artifacts), such as / dev / mem or the Linux kernel image. If operations that are not permitted by the installation protection profile are detected, the installation process can be aborted.

[0040] Different app installation logics (AIL) can also be provided, which are selected based on the installation profile (AIIP) to perform the installation. For example, two differently configured / compiled versions of the dpkg package manager can be provided, which differ in the file system paths they can modify (corresponding to a hard-coded policy in the app installation logic (AIL).

[0041] The corresponding AIIP installation protection profiles can be preconfigured or generated at runtime, e.g., depending on an app manifest that specifies which paths must be modified for an installation. The AIP app installation policy and the dependent AIIP installation protection profiles can be device- or system-specific, so that the protection goals relevant to the specific application of a system can be addressed.

[0042] If the application or app package is checked on a remote server, AIVS in the example, the app installation policy AIP specifies, for example, that the installation of app packages from unknown manufacturers must first be checked on an AIVS server. To do this, the app management logic AML transmits the app package and the installation protection profile that must be adhered to during installation (e.g. specific paths that must not be modified) to the AIVS server. The AIVS server installs the app package in its test runtime environment, which is representative of the system S (e.g. same Linux distribution / base image, digital twin). It is checked whether the app could be installed in compliance with the transmitted installation protection profile. If, for example, unwanted modifications are detected during installation, this is assessed as a violation of the installation protection profile.The verification result is reported back to the app management logic (AML). Based on this, the logic can decide whether to install the app on the system or cancel the installation process.

[0043] It is possible that the AIVS server attaches a cryptographic attestation of the runtime environment to the test result.

[0044] This allows the AML app management logic to assume with a high degree of certainty that the installation took place in an expected, restricted test runtime environment. Alternatively, an attestation can be performed by the AIVS server before the app package is submitted.

[0045] As mentioned above, a test installation of the app package can also be performed on a protected, synthetic test runtime environment on the system itself (e.g. in a dedicated virtual machine, Linux container, special tmpfs / Overlayfs structure), or e.g. the app / device management system.

[0046] The AIVS server or the system's internal test runtime environment may not output a test result, but rather a log of the changes or modifications to the runtime environment, e.g., by comparing the states before and after installation, recording file access, etc. The app management logic can then evaluate the log and decide whether the app package should be installed on the system.

[0047] Furthermore, the restrictions of the installation protection profile can be applied to the runtime permissions of apps. For example, if the installation protection profile specifies that files under / boot may not be modified as part of the installation, this restriction can be applied to a system-internal test runtime environment, e.g., the corresponding runtime isolation profile (e.g., SELinux, AppArmor) of the app.

[0048] Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

[0049] The processes or procedures described above can be implemented using instructions located on computer-readable storage media or in volatile computer memories (hereinafter collectively referred to as computer-readable memories). Computer-readable memories include, for example, volatile memories such as caches, buffers, or RAM, as well as non-volatile memories such as removable media, hard disks, etc.

[0050] The functions or steps described above can be present in the form of at least one instruction set in / on a computer-readable memory. The functions or steps are not tied to a specific instruction set or a specific form of instruction sets, a specific storage medium, a specific processor, or specific execution schemes and can be executed by software, firmware, microcode, hardware, processors, integrated circuits, etc., either alone or in any combination. A wide variety of processing strategies can be used, for example, serial processing by a single processor, multiprocessing, multitasking, parallel processing, etc.

[0051] The instructions can be stored in local memories, but it is also possible to store the instructions on a remote system and access them via a network. In the context of the invention, "computer-aided" or "computer-implemented" can be understood, for example, as an implementation of the method in which, in particular, a processor, which can be part of the (control / computing) device or unit, executes at least one method step of the method. The method can also be implemented in a computer cloud, which can execute the method and thus deliver results of the method to a control / computing device or unit, which can direct corresponding commands or measures to the devices, in particular of the above-mentioned arrangement.

[0052] Unless otherwise stated in the following description, the terms "mapping", "replicating", "receiving", "applying", "outputting", "providing" and the like preferably refer to actions and / or processes and / or processing steps that change and / or generate data and / or convert the data into other data, wherein the data can in particular be represented or present as physical quantities.

[0053] The term "processor," "central signal processing," "control unit," or "data evaluation means" encompasses processing means in the broadest sense, such as servers, general-purpose processors, graphics processors, digital signal processors, application-specific integrated circuits (ASICs), programmable logic circuits such as FPGAs, discrete analog or digital circuits, and any combination thereof, including all other processing means known to those skilled in the art or developed in the future. Processors can consist of one or more devices, units, or devices. If a processor consists of multiple devices, these devices can be designed or configured for parallel or sequential processing or execution of instructions.

Claims

Patent claims 1. A computer-implemented method for carrying out an installation process for an application (APP) on a runtime environment (P) during the operation of a system (S) while checking modifications to be carried out on the runtime environment during the installation process, comprising the following steps: a) Configuring at least one installation protection profile (AIIP) for the runtime environment depending on an installation policy (AIP) provided to control the installation process, wherein the at least one installation protection profile specifies permitted and / or prohibited modifications on the runtime environment during the installation process, and wherein the configuration of the at least one installation protection profile is carried out with the aid of metadata included in the installation package and / or with the aid of states of the runtime environment and / or the system,b) Performing an installation process of an installation package of the application to be installed for verification purposes on a test runtime environment isolated from the runtime environment using the at least one installation protection profile, c) Checking whether the installation process has been carried out in compliance with the installation protection profile, d) Carrying out the installation process of the installation package to be installed on the runtime environment if the verification result is evaluated as positive, e) Otherwise, rejecting or aborting the installation process.

2. Method according to the preceding claim, characterized in that the configuration of at least one installation protection profile (AIIP) is carried out using rights of the runtime environment and / or the system.

3. Method according to one of the preceding claims, characterized in that the test runtime environment is provided on the system in isolation from the runtime environment.

4. Method according to one of the preceding claims, characterized in that the test runtime environment is provided remotely from the system on another system (AIVS).

5. Method according to one of the preceding claims, characterized in that the execution of the installation process is controlled with the aid of one or more installation control units (AIL) configurable with the installation protection profile (AIIP).

6. Method according to one of the preceding claims, characterized in that a cryptographic attestation of the runtime environment is attached to the verification result.

7. Method according to one of the preceding claims, characterized in that the verification result is derived from a protocol created by the test runtime environment regarding modifications carried out during the installation process.

8. System suitable for carrying out an installation process for an application (APP) on a system runtime environment during the operation of a system (S) while checking modifications to be carried out on the runtime environment (P) during the installation process, wherein the system is designed in such a way that the steps a) to e) of claim 1 to be carried out.

9. Computer program product comprising a non-volatile storage medium on which a loadable and executable program code or distributed loadable and executable program code modules are stored, which implements the method according to one of the preceding method claims on a or more processors of a system according to one of the preceding system claims.

Images